GHSA-r7fm-3pqm-ww5w

Source

https://github.com/advisories/GHSA-r7fm-3pqm-ww5w

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-r7fm-3pqm-ww5w/GHSA-r7fm-3pqm-ww5w.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-r7fm-3pqm-ww5w

Aliases

CVE-2025-53633

Published

2025-07-10T17:50:25Z

Modified

2025-07-10T23:21:54Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Chall-Manager's scenario decoding process does not check for zip bombs

Details

Impact

When decoding a scenario (i.e. a zip archive), the size of the decoded content is not checked, potentially leading to zip bombs decompression. Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system.

Patches

Patch has been implemented by commit 14042aa and shipped in v0.1.4.

Workarounds

No workaround exist.

References

N/A.

Database specific

{
    "github_reviewed": true,
    "nvd_published_at": "2025-07-10T20:15:27Z",
    "cwe_ids": [
        "CWE-405",
        "CWE-409"
    ],
    "github_reviewed_at": "2025-07-10T17:50:25Z",
    "severity": "HIGH"
}

References

Affected packages

Go / github.com/ctfer-io/chall-manager

Package

Name: github.com/ctfer-io/chall-manager; View open source insights on deps.dev
Purl: pkg:golang/github.com/ctfer-io/chall-manager

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.1.4